NexusTest
...

Test ve Belgelendirme Merkezi

info@nexustest.com.trEmail+90 506 294 0970
NexusTest
Critical Security

Are Your Digital Assets Vulnerable to Cyber Attacks?

The cybersecurity world is constantly evolving, attackers never rest, and in today's e-commerce world, personal data breaches, intellectual property theft, and ransomware attacks are becoming increasingly common.

Get Security TestingLearn More
Critical Security
Important CRA announcement

11 September 2026: Cybersecurity incident and vulnerability reporting begins

Under the EU Cyber Resilience Act (CRA), manufacturers will be required to report actively exploited vulnerabilities and severe cybersecurity incidents affecting their products through the EU Single Reporting Platform.

1109 / 2026

Reporting timeline

24 hours

Early warning

From the moment the manufacturer becomes aware.

72 hours

Full notification

A comprehensive initial assessment of the incident or vulnerability.

Final report

14 days / 1 month

Within 14 days after a corrective measure for a vulnerability; within one month after the 72-hour submission for a severe incident.

Which products are in scope?

The CRA covers “products with digital elements” whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Product-specific exclusions and interactions with other EU legislation require separate assessment.

IoT and smart devices
Smart-home products and connected appliances
Routers, gateways and network devices
Connected cameras and security systems
Industrial controls, PLCs and automation products
Smart-energy products, EV charging and energy management systems
Commercial software and digital products
Digital components used in connected products

Main CRA obligations apply from 11 December 2027

The reporting duties starting on 11 September 2026 are part of the transition. Most core product cybersecurity and vulnerability-handling obligations will fully apply from 11 December 2027.

Maximum penalty

Non-compliance with the essential cybersecurity requirements and Articles 13 and 14 may result in administrative fines of up to EUR 15 million or 2.5% of total worldwide annual turnover for the preceding financial year, whichever is higher. Corrective or restrictive market-surveillance measures may also apply.

Start preparing now

NexusTest supports manufacturers with CRA scope assessment, product cybersecurity risk assessment, vulnerability management, incident response and reporting readiness, technical documentation and conformity-assessment roadmaps.

Book a CRA readiness call
Official sources:European Commission CRA reporting guidanceEU Regulation 2024/2847

This content is for general information and does not replace product- or company-specific legal or regulatory advice.

Threats You're Facing

Data security is key to an organization's long-term success

Data Breaches

Exposure of personal and corporate data to unauthorized access

Ransomware

Malicious software that locks systems and demands ransom

Intellectual Property Theft

Risk of company secrets and patents being stolen

Advanced Persistent Threats

Long-term and complex cyber attacks (APT)

Protect Your Data with NexusTest

Responsible organizations make large investments to protect their digital assets; however, they often underestimate the security of their assets and fail to take testing steps to ensure their defenses are still strong and current.

Cybersecurity testing conducted by NexusTest can help ensure your data is properly protected.

ETSI EN 303 645 V3.1.3

Security Standard for Consumer IoT Devices

The standard defines high-level cybersecurity and data protection provisions for consumer IoT devices connected to the internet or a home network and for their associated services. ETSI TS 103 701 is used for the systematic assessment of conformity.

Covered IoT Devices:

Connected children's toys and baby monitors
Connected smoke detectors, door locks and window sensors
IoT gateways, base stations and hubs
Smart cameras, televisions and speakers
Wearable health monitors
Connected home automation and alarm systems
Smart appliances like washing machines and refrigerators
Smart home assistants

What does the standard target?

ETSI EN 303 645 is an outcome-focused baseline security framework. Its goal is to catch common design weaknesses such as default passwords, weak update processes, exposed services and poor data protection before products reach the market.

Current EN versionV3.1.3 (September 2024)
Assessment specTS 103 701 V2.1.1 (May 2025)
Security levelBaseline security against common threats

Assessment note

The standard focuses on the most common and important weaknesses rather than prolonged physical access or highly sophisticated threat actors. That is why the assessment combines document review, supplier statements and functional verification.

The device, mobile app, cloud API and back-end services are assessed together when they are part of the consumer solution.
Support period, security update mechanism and vulnerability reporting channel should be clearly defined.
Personal data, telemetry and user data deletion flows are verified in actual product behavior, not only in the UI.

What we focus on during testing

The 13 cybersecurity topics in ETSI EN 303 645 and the related data protection provisions are translated into these control groups in the lab:

Default credentials

We review the absence of universal default passwords, secure identity setup during onboarding and protections against brute-force attacks.

Vulnerability handling

We assess the vendor's vulnerability disclosure process, security contact point and ability to respond to incidents.

Software updates

We verify the update mechanism, integrity protections, declared support period and secure delivery of security patches.

Secure communications and secrets

Keys, tokens, certificates and other sensitive security parameters are checked for secure storage, and network communications are reviewed for secure protocols.

Attack surface and integrity

We review unnecessary services, open ports, debug interfaces, weak API behavior and software integrity controls.

Privacy, resilience and user data

We verify personal data protection, telemetry transparency, resilience to outages, user data deletion and input validation behavior.

Assessment flow according to ETSI TS 103 701

01

Scope and architecture definition

The device, associated services, interfaces, user roles and consumer use case are clarified so the applicable provisions can be identified.

02

ICS / IXIT preparation

Supplier statements, supported security features, update structure, authentication, data processing details and extra test information are collected.

03

Conceptual and functional tests

Based on the TS 103 701 test groups, we perform document review, configuration checks and functional verification of device behavior, including associated services where needed.

04

Findings and remediation

Conformity status, evidence, risk level and corrective recommendations are reported for each applicable clause, followed by a re-test plan where required.

Laboratory and documentation outputs

Applicability matrix and scope definition
ICS / IXIT-based technical assessment record
Functional test results and evidence captures
Corrective action list for non-conformities
Optional re-test and closure verification
RED Cybersecurity

EN 18031 Harmonized Standard Series

EN 18031-1, EN 18031-2 and EN 18031-3 are among the clearest technical routes for demonstrating RED cybersecurity compliance. They are especially relevant for managing network protection, personal data privacy and fraud risks in internet-connected radio equipment.

Regulatory connection

The series supports the essential requirements in RED Article 3(3)(d), 3(3)(e) and 3(3)(f). Its references were published in the OJEU on 30 January 2025, and the related RED cybersecurity requirements became applicable on 1 August 2025.

Scope3 parts / RED 3(3)(d)-(f)
OJEU Reference30 January 2025
Application Date1 August 2025

How NexusTest can support you

We help determine which EN 18031 part applies to your product, build the right test plan, structure the technical file and risk analysis, and manage the laboratory and compliance workflow in one coordinated process.

The three harmonized parts of the series

Article 3(3)(d)
EN 18031-1:2024

Internet-connected radio equipment

Focuses on preventing harm to the network or its functioning. Secure configuration, access control, update management and system hardening expectations are concentrated here.

A critical starting point for routers, gateways, smart devices, connected control units and similar internet-connected products.
Article 3(3)(e)
EN 18031-2:2024

Radio equipment processing data

Targets equipment processing personal data, traffic data or location data. In addition to internet-connected products, it defines extra security expectations for childcare equipment, toys and wearables.

Privacy, parent or guardian access control and secure default settings become especially important in this part.
Article 3(3)(f)
EN 18031-3:2024

Devices processing virtual money or monetary value

Aims to reduce fraud risks in internet-connected radio equipment involved in payments, e-money, digital wallets or similar monetary transactions.

Controls against unauthorized transactions, account takeover and weak authentication are critical in this part.

Compliance timeline

12 January 2022

Delegated Regulation (EU) 2022/30 was published

It defined which classes of radio equipment would be subject to the RED essential requirements in Article 3(3)(d), 3(3)(e) and 3(3)(f).

30 January 2025

EN 18031 references were published as harmonized standards

Commission Implementing Decision (EU) 2025/138 published the OJEU references for EN 18031-1, EN 18031-2 and EN 18031-3.

1 August 2025

Application became mandatory

Following the postponement introduced by Regulation 2023/2444, the RED cybersecurity requirements began to apply in practice from this date.

Important implementation notes

The sections named “rationale” and “guidance” do not on their own provide presumption of conformity; the main assessment should follow the normative requirements.

Allowing the user to continue without setting and using a password can undermine presumption of conformity under the OJEU notices for EN 18031-1, EN 18031-2 and EN 18031-3.

For childcare equipment, toys and wearables under EN 18031-2, parent or guardian access control should be verified carefully.

For EN 18031-3, the fraud-related assessment criteria highlighted in the OJEU notices need additional attention.

Our Cybersecurity Approach

Our security assessment service is designed to identify potential threats and risks to information security

Comprehensive Testing Method

We use our knowledge of advanced persistent threats (APTs) and the tools, tactics, and procedures that real malicious actors would exploit to comprehensively test your organization's cyber defenses.

Ensure all aspects of cybersecurity are covered
Determine the cybersecurity level and exposure of critical assets
Preparedness in detecting and mitigating cyber attacks

Methodological Approach

Our penetration tests are tailored to your business or organization's specific needs to provide a cost-effective solution.

Methodological Approach:

  • Eliminates the possibility of a false sense of security
  • Guarantees consistency of results
  • Ensures all vulnerabilities are found

What You Get with Cybersecurity?

Executive Summary Report

Clear, action-oriented summary for senior management

Evidence-Based Risk Analysis

Evidence-based risk assessment and prioritization

Technical Documentation

Detailed technical documents to reproduce findings

Tactical Recommendations

Immediately actionable short-term solutions

Strategic Recommendations

Roadmap for long-term security strategy

Our Services

Cybersecurity Services Overview

Penetration Testing

We test your systems with real attack scenarios

Vulnerability Assessment

We identify weaknesses in your systems

IoT Security Testing

IoT device testing according to ETSI EN 303 645 standard

Information Security Certification

Compliance with ISO 27001 and other standards

Information Security Certification

With regulated and certified management systems in information security, you create a long-term defense against unexpected events, unauthorized access, and unwanted changes.

Business Continuity

Uninterrupted service delivery

Reputation Protection

Reliability and credibility

Customer Trust

Increased customer loyalty

Leave Your Cybersecurity to Professionals

As NexusTest, we are here to protect your digital assets and build a strong defense against cyber threats.

Request Security TestingAll Services
Cybersecurity Testing and CRA 2026 | NexusTest